{ "media_type": "text", "post_content": "Client is looking for metrics associated with various functions of their security program. What’s a good source/framework for such measures? Thx.", "post_id": "5ad7cc261ca900001454e2e0", "reply_count": 6, "vote_count": 0, "bowl_id": "58f94e5ab298570010451c66", "bowl_name": "Cyber Security Bowl" }

Client is looking for metrics associated with various functions of their security program. What’s a good source/framework for such measures? Thx.

Posting as :
works at
You are currently posting as works at

Not sure there is a formal measurement framework for metrics. CSF and FFIEC IT Security Controls have frameworks for maturity. For SecOps, we look at vulnerabilities (app and infra) incident response time to resolve, num true incidents, phishing campaign repeat offenders and use BitSight for industry and competitor benchmarking

like

NIST CSF is the standard everyone is using.

like

Or cis website if that is what the ask is.

PwCs annual cyber security survey

For vulns, we break it down by CVSS scores and also measure time to remediation

Senior director you got a burner? W9uld love to connect and learn

Related Posts

Acct manager: “Please dont accept any free upgrades as it affects client optics. Save them for your personal travel.” Oh sure. Let me cram myself in the middle seat in economy so client feels better

likefunny

It’s a second time I’m asked to pick up unfinished work from a practice team member moving on to a more interesting project.. I’m new to the firm, and having to pick up work that has been already started is extremely challenging for me.. I don’t really know how to avoid getting in such stressful situations. I’ve reached out to my practice lead and hope to have a candid conversation and adequate feedback. Honestly want to gtfo, but it would suck to look for a new job.. maybe Im being dramatic

like

What kind of client work/industries is shalom is DC doing? What are salaries like for 3rd year manager? Recruiter is telling that work is meaningful. Thoughts??

Lots of us are skilled at delivery but most sales books seem to focus on the pitch and closing... What are your best resources for learning to develop and nurture strong, lasting client relationships?

like

Told I am being rolled off as project is now getting technical and is not my skill set. Team can manage other aspects without me and budget is tight. Is this normal or should I be worried?

like

How do you convince a client you add value?

like

If someone having experience in different sectors then PWC/EY/Deloitte/KPMG consider the employee for job? As I am Electrical Engineer alongwith PGDM Banking Finance and have approx 7 years experience as production Engineer(Solar Manufacturing)-2 yrs, Project and Commissioning Engineer(Oil and Gas Sector)- 2-1/2 yrs and currently Banking operations- 2yrs+. Is there any department suitable for my profile in which I can apply ??

like

Any good recommended books on how to build a scalable product and team? I'm looking for recommendations for two areas: 1) in general laying the groundwork in a startup to have the tools and especially processes in place to scale, and 2) tactical focus on building a SaaS project. I've been promoted into a management role from Dev roots, so need to learn more PM processes to be an effective manager in day job, plus would like to start building my own SaaS solution.

like

Is it okay to just give 1 week notice if you are on bench and not assigned to a project ? Anyone done this ?

like

Hi Excel Geniuses - I am working on an excel project plan and need to classify line items as “workstream” “milestone” “key activity” and “activity” based on their indentation. Can the IF function be used for this?

like

Currently a senior 3 at EY and hope to get promoted to manager next year by October. Is it better to move over to BCG after promotion as a project leader? Or would that not be a lateral move as a EY manager?

How do you deal with openly hostile/aggressive clients? We’re under-resourced and staffing up at the moment so if I was the client I’d be annoyed too, but the current level of hostility is not (con't)

like

Best thing about working from while waiting on new project to start Monday? R2D2 socks with bunny slippers. 🙌🏻 🤖 🐰 🐇

like

How is LBS Captives project in capgemini. Can anyone share the review.

Any good courses to get better at UML Diagramming / Product Architecture Diagramming? Project requires heavily solutions diagramming on my part, want to learn to deliver beautiful, clear diagrams.

like

Ever get annoyed at how happy the partners/MDs are at work everyday knowing it’s probably because they’re making $Mlns from the project? If I see one more “Happy Monday so blessed to be at this client” I’m asking for a raise

likefunny

Make sure client site relationships end with your roll-off date... 😐

like

Partner joined the client zoom call as ‘BabyDaddy’. Client (f) was nice enough to laugh it off but you could see sweat rolling down P’s temples. He couldn’t change it - he dropped off a few times but every single time - ‘BabyDaddy has joined’. My dawg what you got into over thanksgiving??!! 💀💀💀

funnylike

Would you rather be a Cyber SME on a broader project where cyber is just one of many components or otherwise on a project that's 100% cyber focused?

like

Trying to get into project/infrastructure finance roles from tax consulting. Any advise appreciated.

like

Additional Posts

When applying to a new job at a different firm, have you ever acknowledged being gay through involvement? Does it help your chances as a diversity hire?

like

(First ever post) I originally I joined this app to learn from others in consulting on a variety of topics (gender perspectives, comp, tips/ recommendations). Ever since downloading, I see more hatred and people making judgements on others with little context. Consultants are supposed to problem solvers but instead of people sharing perspectives I feel I’m back on Twitter reading threads that only create hate. Anyone else feel that way?

like

Started a new role within my org <1 year ago (been with the co several years) and have received incredibly positive feedback from many people about my performance so far, including my manager. I expressed my desire to revisit my compensation (off-cycle) because I am by all accounts exceeding expectations for my role and my manager was very supportive and encouraged me to provide them with a write up of what I want and why. Any advice? I’ve researched salary comps already

like

Anyone ever had an issue with "quality of deliverable"? I make power points like a good little slave then they are where good enough. Some wisdom from you fam?

like

Question: 14 hour flight coming up and only in economy comfort. Do neck pillows really make a difference? Any suggestions?

like

Just curious...for those that work at Facebook, Twitter, TikTok, social media companies...how do you limit your screen time? Are you so sick of social media at work that you don’t care about it when you get home? Do you let your kids have access?

like

Is anybody working in a good data engineering project where they're getting to learn a lot?

like

What are starting bonuses like at the manager level at big 4 strategy? Having a hard time finding info on this…. Do forms typically forego starting bonuses at that level and index more towards performance bonuses?

like

Just got a Rejection for TPM interview. I thought I did well and gave my best not sure what went wrong. Any suggestions on how to try to figure out what went wrong?

like

Average CD salary at a top shop in NYC?

Is the @Marsh Summer Trac Associate program basically a sales internship?

like
like

Just passed my CISSP on my third attempt!! Took over a year of studying and two bootcamps to finally accomplish this goal. The pressure of everyone knowing I was at a bootcamp both times and (cont.)

likeupliftingsmart

What/Who is Compensation Communicator?

like

I was interviewed for a role with a bank almost 3 months back. Till date I havent heard back on the outcome. Do you think it makes sense now to drop a note to one of the interviewers to get an update?

funnylike

Applying to some roles at Spotify (business analyst, does anyone have any tips to stand out?

If I say "deep learning" enough times, do I get a promotion still these days?

likefunny

Facebook recruiter MIA and have an interview set up for Monday. They scheduled my interview on Tuesday and have not heard from anyone on why to expect. So frustrating. How do I prep?

likehelpful

Looking for a director-level social / digital role. Currently at a start up. Formerly ran social at a large NYC agency. Anybody know of anything? Kinda desperate to get out of where I am right now.

anyone have a good goodnotes template they use for taking notes / tracking project work on their iPad?

like

New to Fishbowl?

Download the Fishbowl app to
unlock all discussions on Fishbowl.
Download Fishbowl to see what others are saying
That was just a preview…
Sign Up to see all discussions
  • Discover what it’s like to work at companies from real professionals
  • Get candid advice from people in your field in a safe space
  • Chat and network with other professionals in your field
Sign up in seconds to unlock all discussions on Fishbowl.

Already a user?
Login here

Share

Embed this post

Copy and paste embed code on your site

Preview

Download the Fishbowl app

Get realtime notifications and see
what's happening in your industry
from the palm of your hand.

For account settings, visit Fishbowl on Desktop Browser or

General

Legal